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REMARKS 

This Application has been carefully reviewed in light of the Final Office Action 
electronically delivered August 20, 2007. In order to advance prosecution of this case, 
Applicants amend Claims 12, 14, and 23. Applicants previously canceled Claims 2-3, 6-7, 
and 18-19 without prejudice or disclaimer. Applicants respectfully request reconsideration 
and favorable action in this case. 

Section 101 Rejections 

Claims 12-16 and 20 are rejected under 35 U.S.C. § 101 for allegedly being directed 
to non-statutory subject matter. Applicants respectfully traverse this rejection. Nonetheless, 
for purposes of advancing prosecution, Applicants amend Claims 12 and 14, thereby 
obviating the Examiner's rejection. 

Section 103 Rejections 

Claims 1, 4, 10-16, 21 and 22 are rejected under 35 U.S.C. § 103(a) as being 

unpatentable over U.S. Patent No. 6,192,512 issued to Chess ("Chess") in view of U.S. Patent 

No. 5,389,196 issued to Chambers ("Chambers"). Claim 1 recites: 

A method of detecting viral code in subject files, comprising: 

creating an artificial memory region spanning one or more components 

of the operating system; 

emulating execution of at least a portion of computer executable code 

in a subject file; 

monitoring operating system calls by the emulated computer 
executable code to detect an attempt by the emulated computer executable 
code to access the artificial memory region; and 

determining based on the attempt to access the artificial memory 
region that the emulated computer executable code is viral. 

Applicants respectfully note that Chess and Chambers both alone and in combination, 
fail to disclose, teach, or suggest every element of Claim 1. For example, the proposed 
Chess-Chambers combination fails to disclose : "monitoring operating system calls by the 
emulated computer executable code to detect an attempt by the emulated computer 
executable code to access the artificial memory region" as recited by Claim 1. Thus, the 
proposed Chess-Chambers combination fails to disclose, teach, or suggest every element of 
Claim 1. 
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More specifically, as the Examiner concedes Chess individually fails to "disclose 
monitoring operating system calls by the emulated computer executable code to detect an 
attempt to access the artificial memory." Office Action, p. 4. Furthermore, combining Chess 
with Chambers fails to remedy this omission as Chambers also fails to disclose this element 
of Claim 1. In particular, the portion of Chambers referenced by the Examiner in addressing 
this element states only that the described monitor program "can be executed explicitly by the 
user with a designated target program, or in alternative embodiments can be executed 
automatically whenever an operating system call is placed to execute a program." Chambers, 
col. 6, 11. 64-68. Thus, the cited portion of Chambers indicates only that the described 
monitoring program is executed whenever an operating system call is placed to execute a 
target program. While this target program may then be emulated to detect viral behavior 
{Chambers, Abstract), the cited portion of Chambers does not disclose "monitoring operating 
system calls by the emulated computer executable code . . (emphasis added). Thus, the 
proposed Chess-Chambers combination fails to disclose "monitoring operating system calls 
by the emulated computer executable code to detect an attempt by the emulated computer 
executable code to access the artificial memory region" as required by Claim 1 . 

In addition, the proposed Chess-Chambers combination is improper. Applicants 
respectfully note that, for an obviousness rejection to be appropriate, the Examiner must 
"identify a reason that would have prompted a person of ordinary skill in the relevant field to 
combine the elements in the way the claimed new invention does." KSR Intern. Co. v. 
Teleflex Inc., 127 S.Ct. 1727, 1742. (2007). "[A] patent composed of several elements is not 
proved obvious merely by demonstrating that each of its elements was, independently, known 
in the prior art." Id. Applicants respectfully submit that the Examiner's explanation for 
combining the cited references fails to satisfy this requirement. 

In particular, the Examiner indicates that the motivation for this combination "would 
have been to detect viral activity and report the status of all operating system requests 
performed by the program." Office Action, p. 4. Nonetheless, the system of Chambers on its 
own provides this functionality. See Chambers, col. 7, 11. 55-57; Abstract. Thus, a desire to 
"detect viral activity and report the status of all operating system requests performed by the 
program" is insufficient motivation for combining the teachings of Chess and Chambers, as 
Chess on its own provides this functionality. As a result, the Examiner has not identified a 



DAL0 1:984949.1 



ATTORNEY DOCKET NO. 063170.6291 

12 



PATENT 
Serial No. 09/905,532 



reason that would have prompted a person of ordinary skill in the relevant field to combine 
the elements in the way the Examiner proposes. Consequently, the proposed Chess- 
Chambers combination is improper for at least these reasons. 

As a result, the proposed Chess-Chambers combination fails to disclose, teach, or 
suggest every element of Claim 1 . Moreover, the proposed Chess-Chambers combination is 
improper. Claim 1 is thus allowable for at least these reasons. Applicants respectfully 
request reconsideration and allowance of Claim 1 and its dependents. 

Although of differing scope from Claim 1, independent Claims 10-12 and 14 include 
elements that, for reasons substantially similar to those discussed with respect to Claim 1, are 
not disclosed by Chess. Claims 10-12 and 14 are thus allowable for at least these reasons. 
Applicants respectfully request reconsideration and allowance of Claims 10-12 and 14, and 
their respective dependents. 

Claims 8, 9, 20 and 23 are rejected under 35 U.S.C. § 103(a) as being unpatentable 
over Chess and Chambers in view of U.S. Patent No. 5,974,549 issued to Golan ("Golan"). 
Claims 8, 9, and 23 depend from Claim 1, while Claim 20 depends from Claim 14. Claims 1 
and 14 have been shown above to be allowable. Claims 8, 9, 20, and 23 are thus allowable 
for at least these reasons. Applicants respectfully request reconsideration and allowance of 
Claims 8, 9, 20, and 23. 

In addition, several of the dependents of Claims 1, 10-12, and 14 include additional 
elements that are not disclosed by the cited references. As one example, Claim 23 recites: 
The method of claim 1, further comprising: 

monitoring access by the emulated computer executable code to 
dynamically linked functions; and 

determining based on attempted access to dynamically linked functions 
that the emulated computer executable code is viral. 

Chess, Chambers, and Golan, both alone and in combination, fail to disclose every 
element of Claim 23. For example, the proposed Chess-Chambers-Golan combination fails 
to disclose "determining based on attempted access to dynamically linked functions that the 
emulated computer executable code is viral." The portion of Golan referenced by the 
Examiner in addressing this element indicates only that the described security monitor "can 
be implemented as a Windows Dynamic Link Library (DLL)" and that "a software 
component can only breach security by calling a system call termed an API call." Golan, col. 
6, 11. 7-9; col. 5, 11. 38-41. The cited portion does not indicate that the system of Golan 
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"determines] based on attempted access to dynamically linked functions that the emulated 
computer executable code is viral." Thus, the proposed Chess-Chambers-Golan combination 
fails to disclose "determining based on attempted access to dynamically linked functions that 
the emulated computer executable code is viral" as required by Claim 23. 

As a result, the proposed Chess-Chambers-Golan combination fails to disclose 
additional elements of Claim 23. Claim 23 is thus allowable for at least this additional 
reason. Applicants respectfully request reconsideration and allowance of Claim 23. 
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Conclusions 

Applicants have made an earnest attempt to place this case in condition for allowance. 
For the foregoing reasons, and for other reasons clearly apparent, Applicants respectfully 
request full allowance of all pending Claims. If the Examiner feels that a telephone 
conference or an interview would advance prosecution of this Application in any manner, the 
undersigned attorney for Applicants stands ready to conduct such a conference at the 
convenience of the Examiner. 

The Commissioner is hereby authorized to charge the $810.00 RCE filing fee and any 
other required fees or to credit any overpayments to Deposit Account No. 02-0384 of Baker 
Botts L.L.P. 



Respectfully submitted, 



BAKER BOTTS L.L.P. 
Attorneys for Applicants 

Todd A. Cason 
Reg. No. 54,020 

2001 Ross Avenue, Suite 600 
Dallas, Texas 75201-2980 
(214) 953-6452 
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